[auth] dont activate authenticationMiddleware if secret is missing. NO SECRET ONLY IN FULLY PUBLIC DOMAINS!!!

2022-01-21 14:39:34 +01:00 · 2022-01-21 14:39:34 +01:00 · 2e5680d29a
parent 979007f287
commit 2e5680d29a
1 changed files with 5 additions and 4 deletions
--- a/halfapi/halfapi.py
+++ b/halfapi/halfapi.py
@ -129,10 +129,11 @@ class HalfAPI(Starlette):

        self.add_route('/', JSONRoute(schemas))

-        self.add_middleware(
-            AuthenticationMiddleware,
-            backend=JWTAuthenticationBackend()
-        )
+        if SECRET:
+            self.add_middleware(
+                AuthenticationMiddleware,
+                backend=JWTAuthenticationBackend()
+            )

        if not PRODUCTION:
            self.add_middleware(